Vercel has released security patches for two critical severity vulnerabilities in the Next.js web framework. Both flaws enable unauthenticated remote code execution (RCE), representing a significant security risk for organizations utilizing this framework. The first vulnerability is exploitable through specially crafted AVIF image files, while the second involves a path traversal flaw that specifically impacts servers using a Windows filesystem.

The Windows path traversal vulnerability is tracked as CVE-2026-75604. This flaw allows an attacker to bypass security restrictions by manipulating file paths, potentially leading to unauthorized system access. The AVIF image processing vulnerability similarly allows external actors to execute arbitrary code without authentication, highlighting risks in how the framework handles specific media formats.

IT leaders and operations teams should prioritize these updates to secure their web infrastructure. Because these vulnerabilities allow unauthenticated RCE, they pose a high risk of compromise for exposed servers. Organizations running Next.js on Windows environments or processing image uploads are particularly vulnerable and should verify their current versions against the latest security patches provided by Vercel.

The BroadVision view

These vulnerabilities highlight the necessity of maintaining updated framework versions and securing file processing pipelines. IT leaders should verify patch status for all Next.js deployments, especially those hosted on Windows environments. Comprehensive monitoring and vulnerability management are essential components of maintaining a secure environment through managed IT services.